Implementing custom auth in linkerd

[ParkashBansal]

We are planning to implement service mesh for our services and we are evaluating linkerd2 as part of it. We want to implement our own custom authentication for the incoming requests and reject and accept the calls based on that.
Similarly we want to add custom auth tokens to the outbound calls.
Plus we want to add other features like rate limiting, CircuitBreakers etc. Although these are nice to have initially.
We want these features to be added in a ServiceMesh / Sidecar Proxy so that our main microservices are free of these common boilerplate code.
I want to understand is this achievable through linkerd extensions. We already have a Java based API gateway which does most of these. So if it can be done through extensions it will be great as it will reduce lot of effort for writing all of that features again. If its possible through extensions, can someone point me how to write your own extensions as there is no documentation available on what it takes to write your own extension.
If not extensions, then is it possible to extend linkerd2-proxy code and implement these in that. What would be the required sections in proxy code that we may have to touch upon to add these.
Happy to discuss more on this and thanks in advance